0.tcp.eu.ngrok[.]ioDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Managing Attack Surface“… day 2 consisted of attempts to create a reverse shell directly through PowerShell commands issued via sqlservr.exe, connecting to 0.tcp.eu.ngrok[.]io, the same host listed in maa.php and fata.php.”
Indicators reported together
named in the same reports- hxxps://raw.githubusercontent[.]com/hightidAOaa/azdaz/main/maa.phpin 1 report
- 41.102.167[.]182in 1 report
- 35.195.172[.]146in 1 report
- hxxps://github[.]com/hightidAOaa/azdaz/raw/main/fata.phpin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.